codeql-action icon indicating copy to clipboard operation
codeql-action copied to clipboard

Published 20 hours ago • verified publisher icon github

Create pull request based on data in SARIF file

Open varunsh-coder opened this issue 2 years ago • 2 comments

The ossf/scorecard project will add recommended fixes for security issues in the SARIF file. In such cases,

  1. Is it possible to show a "Copy code snippet" button in the SARIF view in GitHub? So, the developer can copy the fixed file, and paste it in their code.
  2. Is it possible to have a "Create Pull Request" button feature that will create a PR based on the fix in the SARIF file?

It is possible to create an OAuth/Github App to create the PR, but the app will need write access to the repo (to create a branch), and we are trying to avoid creating an App with write access to the repo. Would be great if there was direct integration in the GitHub Code Scanning UI to create a PR/ enable copying code based on metadata in the SARIF file.

/cc @laurentsimon

varunsh-coder avatar Apr 26 '22 00:04 varunsh-coder

Hi @varunsh-coder,

Thanks for your issue. These are all very good ideas, and I'll bring them to the appropriate engineering team.

MathiasVP avatar Apr 26 '22 08:04 MathiasVP

/cc @josepalafox

laurentsimon avatar Apr 27 '22 14:04 laurentsimon